CVE-2026-108747

Lightdash versions through 2.556.0 are vulnerable to an authorization bypass (CWE-639) that allows authenticated organization members to delete other users' personal access tokens . By sending a DELETE request to the personal-access-tokens route with a victim's token UUID, an attacker can revoke ...

EUVD-2026-96897

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the canonlyjoinviainvite setting. Attackers with the Raven User role can call the joinworkspace method to become persistent members, reading a...

ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

EUVD-2026-96576

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...

CVE-2026-108637

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the deleteUserGroupBatch endpoint. A low-privileged authenticated user can call DELETE /sys/user/deleteUserGroupBatch to remove user group members by providing any groupId and comma-separated userIds. This allows t...

CVE-2026-102402

The Team – Team Members Showcase Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.0.2 . The root cause is insufficient input sanitization and output escaping regarding the 'ttp_filter_taxonomy' parameter (meta of an attacker-chosen post...

EUVD-2026-96212

The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttpfiltertaxonomy meta of the attacker-chosen post' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-102402 Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode

The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttpfiltertaxonomy meta of the attacker-chosen post' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2021-25374_Samsung-Account-Access

CVE-2021-25374 - Samsung-Konto-Zugriffsskript Dieses Skript kann verwendet werden, um Zugriff auf das Samsung-Konto eines Opfers zu erhalten, wenn auf dem Samsung-Gerät eine bestimmte Version von Samsung Members installiert ist und das Gerät des Opfers aus der Region USA oder Korea stammt. So...

WordPress Team – Team Members Showcase Plugin plugin <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Team versions = 6.0.2...

TeleGram-Scraper

Telegram Group Scrapper • API-Einrichtung Gehe zu http://my.telegram.org und melde dich an. Klicke auf API-Entwicklungstools und fülle die erforderlichen Felder aus. Gib einen gewünschten App-Namen ein und wähle „other“ anderes als Plattform. Beispiel: Kopiere „apiid“ & „apihash“ nach dem Klick a...

gitrob

Gitrob: Putting the Open Source in OSINT Gitrob is a tool to help find potentially sensitive files pushed to public repositories on Github. Gitrob will clone repositories belonging to a user or organization down to a configurable depth and iterate through the commit history and flag files that...

EUVD-2026-44644

PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization...

PS-CVE-2021-44228

PS-CVE-2021-44228 Detecção estática de bibliotecas log4j vulneráveis em membros Windows de um domínio AD. Utiliza o binário da ferramenta de detecção fornecido por @1lann : https://github.com/1lann/log4shelldetect Pré-requisitos Privilégios de administrador nos computadores alvo. Módulo PowerShel...

CVE-2026-26012

CVE-2026-26012 — PoC de Enumeração de Ciphers do Vaultwarden Enumeração Completa de Ciphers Ignorando Permissões de Coleção da Organização Uma prova de conceito de exploração para CVE-2026-26012, uma vulnerabilidade de controle de acesso quebrado no Vaultwarden = 1.35.2 que permite que qualquer...

CVE-2026-107637

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

CVE-2026-107636 pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController

pH7Builder pH7 Social Dating CMS before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set itemnumber, cartorderid, or the PayPal custom field while...

CVE-2026-104962

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/projectid/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...

EUVD-2026-92483

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/projectid/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...

CVE-2026-104955 Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)

Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/workspaceslug/projects/projectid/members/memberpk/ to change another user's project role. The role-update logic blocks...